Google Details LLMjacking Cloud Fraud Reaching $1 Million

Google has warned that attackers are hijacking enterprise access to large language models in attacks it calls LLMjacking, with fraudulent cloud consumption exceeding $100,000 in a single day in some incidents. Google Threat Intelligence Group and Mandiant said cumulative charges at some affected organizations reached $1 million before the access was revoked.

The activity has affected organizations in North America, South America and Asia Pacific, including financial services, retail, technology and transportation companies. Rather than targeting a customer-facing chatbot to make unauthorised requests, LLMjacking targets the backend model resources and leaves the legitimate account owner responsible for the bill.

Stolen identities open the path to model resources

Attackers can obtain LLM access through phishing, source-code leaks, exposed client-side code and misconfigured environments. Google identified exposed or stolen cloud identity tokens as the most common initial access route, including IAM credentials, Service Account keys, GitHub Personal Access Tokens and active session tokens.

Google attributed one observed intrusion to UNC6993, which used a misconfigured Service Account key to breach a cloud instance and obtain access to an LLM API. The group also ran a session-hijacking page disguised as an application portal. Victims were directed to a legitimate LLM service and prompted to paste raw JSON containing an active access token; the token was then sent to an attacker-controlled backend API, bypassing password and multi-factor authentication controls.

Other cases involved a stolen Personal Access Token used to enter private repositories, followed by exploitation of a suspected web-application vulnerability in a package operating in a containerised cloud environment. Google also described compromised corporate IAM credentials used to generate new access keys, as well as broadly privileged Service Account keys and LLM API keys exposed in public GitHub repositories.

Rapid monetisation changes the cloud-risk profile

Once inside, operators enumerate cloud services, repositories and data stores for credentials; map services and identity policies across regions; inspect logs; and seek permissions for escalation and persistence. They may create unauthorised IAM or service accounts, add SSH keys to compute instances, or generate temporary credentials for high-privilege service accounts.

Google said the ultimate aim is monetisation through token proxying, automated model streaming and GPU hardware provisioning. UNC6993 created additional API keys within victim cloud projects and generated more than $100,000 in billing charges. Some actors use a “burn and rotate” approach, repeatedly creating and deleting short-lived service accounts to evade rate limits.

The company also described “LLM Mixers”, illicit routing gateways that proxy, aggregate and resell unauthorised LLM access. Separately, Symantec and Carbon Black reported a relay service that installs genuine OpenAI Codex and Anthropic Claude Code command-line tools, then alters their configuration so requests go through third-party infrastructure rather than vendor servers.

What organisations should review

For businesses deploying higher-tier models or agentic workflows, cloud identity protection and cost monitoring are inseparable controls. Teams should review exposed API keys and Service Account permissions, protect source repositories and client-side code, and investigate abrupt LLM consumption or unexpected account creation before fraudulent use becomes a major cloud charge.